Re: [PATCH v2] io_uring/fdinfo: ignore IORING_CQE_F_32 in last CQ array slot

[Jens Axboe]

On Fri, 11 Sep 2026 19:56:13 +0200, Jann Horn wrote:
> A cqe32 entry spans two CQ array slots, so the last CQ array slot can't
> contain a cqe32 entry. If the CQ tail points at the last CQ array slot and
> the kernel wants to write a cqe32 entry, it uses io_fill_nop_cqe() to pad
> the last CQ array slot with a dummy entry and make the tail wrap around.
> 
> However, malicious userspace can directly set IORING_CQE_F_32 on the last
> CQ array slot, causing __io_uring_show_fdinfo() to read the second cqe32
> half from beyond the CQ array. Change __io_uring_show_fdinfo() to
> explicitly ignore the IORING_CQE_F_32 flag in this case.
> 
> [...]

Applied, thanks!

[1/1] io_uring/fdinfo: ignore IORING_CQE_F_32 in last CQ array slot
      commit: ab394388d05977f369e8e8d1beceae47fc3c5e72

Best regards,
-- 
Jens Axboe